Information Security Program Manager, Continuous Monitoring - FedRAMP

About The Team:

The Information Security organization advances the overall state of security at Rubrik through purposeful initiatives and coordination of large security projects. Information Security builds technologies, tools, and processes to better enable teams at Rubrik to develop secure software and protect data and systems with appropriate security controls. Information Security also develops systems to monitor and respond to attacks against our systems, provides awareness education to teams on security best practices for data protection, and ensures data sharing relationships with third parties in order to securely protect Rubrik information.

About the role:

Our Public Sector Product Certification and Compliance Team is looking for a success-driven, US-based Program Manager to organize, plan, and execute on continuous monitoring and related compliance activities for Rubrik’s government cloud service offering(s).  This mission-critical position will enhance, control, and execute our compliance monitoring, continuous assurance, and monthly reporting programs in accordance with Rubrik’s Continuous Monitoring strategy and policy for FedRAMP and other product certification frameworks. 

Externally, this role represents Rubrik with FedRAMP and StateRAMP PMOs, DISA, our Government / Agency Partner(s), and our third party assessment organization (3PAO).  Internally, this role collaboratively influences product, engineering, compliance, and risk road maps. The incumbent will help Rubrik accelerate and assure the growth of our govcloud service offerings through diligent continuous monitoring, timely government reporting, and security assessment & authorization activities for in-scope product certifications. 

Our ideal candidate is a subject matter expert in FedRAMP, NIST SP800-53, NIST SP800-171, and Department of Defense Impact Level security requirements, with previous experience in assessment, authorization, and continuous monitoring activities for a Cloud Service Provider (CSP vs. Cloud Hosting Platform Provider). They will also need to bring a relentless focus and  accountability for results, and excellent leadership, communication, decision-making, and collaboration skills. 

What you'll be doing:

Program / Development

• Program Manager / Service Lead / Control Owner for Rubrik’s Continuous Monitoring (ConMon) Compliance capability, covering requirements for FedRAMP, DoD Impact Level, CJIS, and similar frameworks. Others will perform scanning, inventory, and flaw remediation; your role is to ensure that effective ConMon strategy, plans, and related procedures are compliantly in place and working effectively, and that system vulnerabilities are appropriately POA&M-documented, managed to remediation, reported compliantly, and addressed on a timely basis.
• Maintain the calendar of continuous monitoring activities covering weekly, monthly, quarterly, and annual compliance requirements for FedRAMP, DoD Impact Level, and similar programs.
• As our secondary/backup Information Systems Security Officer (ISSO), collaborate with a range of stakeholders from individual contributors to senior leadership to external parties including Agency Partners and/or Third Party Security Assessor (3PAO). 
• Drive activities related to the remediation of technical security and compliance risks with cross-functional teams, including, but not limited to, engaging third party services, managing remediation projects, leading groups to consensus and action, assigning and tracking work items, producing reports, and escalating risks and issues.
• Serve as a subject matter expert and an integral member of the Public Sector Product Certifications and Compliance Team, cultivating strong relationships across the company to aid in program transparency,  strategic consensus, expectation setting, risk and vulnerability awareness, and continual process improvement.
• Monitor changes in relevant regulations, laws, and industry standards to adapt the program accordingly. Identify challenges with emerging compliance requirements and best practices to sustain compliance as the landscape evolves. 

Operations

• Working with the primary ISSO, write, maintain, and disseminate all or parts of Rubrik’s government Authorization Package(s) and related artifacts as a cohesive body of work, obtaining content and updates from Control Owners when needed and ensuring the package is correct, complete, and current.
• Manage the Plan of Action and Milestones (POA&M) workbook and use it to log and report vulnerability remediation status for Rubrik’s government cloud service offering(s).
• Package and submit monthly ConMon reporting with remediation evidence, and independently manage similar duties for FedRAMP, StateRAMP,  Department of Defense and other Authorizations and Attestations.
• Ensure Agency Partner approval or concurrence for monthly reporting (POA&M closures, deviation requests, and significant change handling) and annual test plans or exercises (Incident Response,  Information System Contingency Plan, and Red Team testing).
• Respond to Executive Orders, requests from CISA and other entities that require responsive action or reporting, and assist as needed with incident response involving public sector organizations.
• Lead the FedRAMP Training program, ensuring annual refresh of content by content owners, enrolling and tracking required FedRAMP and CJIS training for users, and follow up to suspend access when users fail to complete their training on a timely basis. 
• As time permits, participate in Change Control Board activities, supporting security impact analyses and scoping controls for significant changes. Raise questions and make recommendations when needed to help determine whether requested changes should be approved and implemented as presented.
• Cover “other duties as assigned” that may fall outside of core responsibilities to help ensure the team’s success.

Technical

• ISSO duties: assist and/or cover for the ISSO in planning for, preparing for, and executing on assessments by analyzing information and conducting interviews to identify areas of non-compliance and prepare control owners for annual review.  
• Develop and manage activities using JIRA as a primary project and work tracking tool.
• Drive automation where opportunities exist for effectiveness, efficiency, and scalability.
• Produce ConMon / Auth Package artifacts in OSCAL format using GRC tooling
• Develop and share expertise in cloud services (GCP, Azure, AWS) and cloud security.

Experience you’ll need:

• 6+ years of related work experience in Information Security or relevant Compliance roles in the tech / SaaS industry (previous experience in a SaaS company context preferred)
• 4+ years of experience in a U.S. public sector compliance role associated with FedRAMP, DoD Impact Levels, Controlled Unclassified Information, and/or government Assurance & Authorization activity
• Solid writing skills in Authorization Package artifacts like System Security Plan, Customer Responsibility Matrix, System-specific Policies, and SSP Appendices
• Relentless attention to detail for accuracy and conformance but able to put progress over perfection at the macro level
• Leader by influence, able to address conflict productively and professionally, solid sense of humor,  keeps things in perspective
• Resourceful and resilient in a dynamic, high velocity, business environment that’s sometimes like a start up
• Comfortable wearing many hats in a small, agile team that enjoys working together to get things done
• Subject Matter Expert / SME with advanced knowledge of government compliance and cloud security risks, vulnerabilities, and threats, and can take these issues through triage / risk treatment conversations
• Deep understanding of relevant information security frameworks, including FedRAMP, NIST 800-53, NIST 800-171, CJIS, and DoD Cloud Security Requirements Guide
• Develops plans and roadmaps, and implements cross-functional policy, process, and procedures to meet planned objectives
• Hands-on experience with agile project management tools (e.g., Jira, Confluence).
• Detail-oriented and able to understand the bigger picture by using technical expertise and problem solving abilities to prioritize efforts and work through ambiguity and issues
• Ability to ramp up quickly and learn new technologies with minimal lag time
• Familiarity with / interest in use of OSCAL for automation is a plus
• Bachelor’s degree or equivalent in Security, Computer Science, Management Information Systems, Business Administration or related field preferred
• Professional certifications in Information Security, Cloud Security, and/or Systems Audit/Assessment (e.g., CISSP, CISA, CCSK) preferred, Project Management skills a plus

Security and Privacy Responsibilities: 

This position carries special Security and Privacy Responsibilities for protecting the U.S. Federal Government’s interests:

• Know, acknowledge, and follow system-specific security policies and procedures;
• Protect data and individual privacy per requirements and regulations;
• Perform ongoing activities in compliance with service and contractual obligations;
• Participate in role-based training, completing assignments on a timely basis; 
• Report security issues promptly, and aid investigation when needed;
• Support controlled changes and vulnerability remediation activities; and
• Work collaboratively with Information Security in designing, implementing, assessing or enhancing system-specific security and privacy controls. 

Position Risk Designation:

This position carries duties and responsibilities involving the U.S. Federal Government’s interests. The selected incumbent may be subject to one or both of the additional background checks with periodic re-screening as noted below:

Position Risk Designation: Non-Sensitive, Low Risk, Tier 1 

Incumbents without access to U.S. Government data may be required to complete Standard Form 85 and undergo a Tier 1 Investigation (T1) for non-sensitive positions of Low Risk. (Baseline screening; formerly National Agency Check and Inquiries (NACI)).

Position Risk Designation: Non-Sensitive, Moderate Risk, Tier 2 (Public Trust)

Incumbents with access to U.S. Government data may be required to complete Standard Form 85P and undergo Tier 2 (T2) Investigation for non-sensitive positions designated Moderate Risk.

Position Risk Designation:Moderate Risk Law Enforcement (CJIS)

When hired for a position where access to Moderate Risk criminal justice information is required, the employee must complete a fingerprint-based national criminal history background check within 30 days after the employee’s start date.